@deeeed/metamask-harness 0.68.0 → 0.70.0

package/adapters/extension/lib/macos-focus.cjs

@@ -1,236 +1,108 @@
 'use strict';
 
-const { execFileSync, spawn } = require('node:child_process');
-const fs = require('node:fs');
+// macOS focus helpers for launchers that start a headed browser in the
+// background. One owner (the launcher) and one decision: after the launch
+// settles, if the frontmost process is one of OUR browser pids, give the front
+// back to the app that had it, once, by pid. Anything else in front (the
+// operator's own Chrome included, whatever its bundle) is left alone. A restore
+// only activates an already-running app (never `open -a`, which can launch).
+// MM_HARNESS_FOCUS_HOLD=0 makes every function here a no-op (tests).
 
-// Window activation is not sub-20ms; 80ms keeps the hold responsive while
-// spawning far fewer lsappinfo/open subprocesses per second.
-const HOLD_INTERVAL_MS = 80;
-// Upper bound for one Launch Services query or `open -a`. A short bound made a
-// loaded Mac time out the first query, which silently disabled the whole hold.
-const LS_TIMEOUT_MS = 2000;
-// Hard cap on a hold whose parent is alive but never released it.
-const HOLD_MAX_MS = 120_000;
-const toolEnv = () => ({ ...process.env });
+const { execFileSync } = require('node:child_process');
 
-function captureMacFrontmost() {
-  if (process.platform !== 'darwin') return null;
-  try {
-    const asn = execFileSync('lsappinfo', ['front'], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }).trim();
-    if (!asn) return null;
-    return parseLsappinfo(execFileSync('lsappinfo', ['info', asn], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }));
-  } catch {
-    // Best effort: lsappinfo missing, timed out, or the app exited; no focus to preserve.
-    return null;
-  }
+// Upper bound for one Launch Services query or activation.
+const LS_TIMEOUT_MS = 2000;
+// Activates a running app by pid; prints "missing" for a pid with no app.
+const ACTIVATE_BY_PID = [
+  'function run(argv) {',
+  "  ObjC.import('AppKit');",
+  '  const app = $.NSRunningApplication.runningApplicationWithProcessIdentifier(Number(argv[0]));',
+  "  if (!app || app.isNil()) return 'missing';",
+  "  return app.activateWithOptions($.NSApplicationActivateIgnoringOtherApps) ? 'ok' : 'failed';",
+  '}',
+].join('\n');
+
+function macFocusDisabled() {
+  return process.platform !== 'darwin' ||
+    process.env.MM_HARNESS_FOCUS_HOLD === '0' ||
+    process.env.MM_HARNESS_FOCUS_BROWSER === '1';
 }
 
-function captureMacFrontmostProcess() {
-  return captureMacFrontmost()?.pid ?? null;
+// At most one restore per launcher process.
+let restored = false;
+
+function lsappinfo(args) {
+  return execFileSync('lsappinfo', args, {
+    encoding: 'utf8',
+    env: { ...process.env },
+    stdio: ['ignore', 'pipe', 'ignore'],
+    timeout: LS_TIMEOUT_MS,
+  });
 }
 
 function parseLsappinfo(info) {
   const pid = Number.parseInt((info.match(/\bpid\s*=\s*(\d+)/u) || info.match(/"pid"=(\d+)/u) || [])[1], 10);
   const bundlePath = (info.match(/bundle path="([^"]+)"/u) || info.match(/"LSBundlePath"="([^"]+)"/u) || [])[1];
   const name = (info.match(/^"([^"]+)"/mu) || info.match(/"LSDisplayName"="([^"]+)"/u) || [])[1];
-  if (!Number.isInteger(pid) || pid <= 0 || !bundlePath) return null;
-  return { pid, bundlePath, name: name || bundlePath };
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  return { pid, bundlePath: bundlePath || null, name: name || bundlePath || `pid ${pid}` };
 }
 
-function currentFrontmostPid() {
+// The frontmost app as { pid, bundlePath, name }, or null when unknown.
+function captureMacFrontmost() {
+  if (macFocusDisabled()) return null;
   try {
-    const asn = execFileSync('lsappinfo', ['front'], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }).trim();
-    if (!asn) return null;
-    const value = execFileSync('lsappinfo', ['info', '-only', 'pid', asn], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }).trim();
-    const pid = Number.parseInt((value.match(/"pid"=(\d+)/u) || [])[1], 10);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
+    const asn = lsappinfo(['front']).trim();
+    return asn ? parseLsappinfo(lsappinfo(['info', asn])) : null;
   } catch {
-    // Best effort: lsappinfo unavailable or timed out; callers treat null as unknown.
+    // Best effort: lsappinfo missing, timed out, or the app exited.
     return null;
   }
 }
 
-function restoreMacFrontmost(target) {
-  if (process.platform !== 'darwin' || !target?.bundlePath) return false;
-  try {
-    execFileSync('open', ['-a', target.bundlePath], {
-      env: toolEnv(),
-      stdio: 'ignore',
-      timeout: LS_TIMEOUT_MS,
-    });
-    return true;
-  } catch {
-    // Best effort: `open -a` failed or timed out; the operator keeps whatever is in front.
-    return false;
-  }
+function macFrontmostPid() {
+  return captureMacFrontmost()?.pid ?? null;
 }
 
-function restoreMacFrontmostProcess(pid) {
-  if (process.platform !== 'darwin' || !Number.isInteger(pid) || pid <= 0) return false;
+// Bring an already-running app to the front by pid. Never launches anything.
+function activateMacAppByPid(pid) {
+  if (macFocusDisabled() || !Number.isInteger(pid) || pid <= 0) return false;
   try {
-    const asn = execFileSync('lsappinfo', ['find', `pid=${pid}`], {
+    return execFileSync('osascript', ['-l', 'JavaScript', '-e', ACTIVATE_BY_PID, String(pid)], {
       encoding: 'utf8',
-      env: toolEnv(),
+      env: { ...process.env },
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: LS_TIMEOUT_MS,
-    }).trim();
-    if (!asn) return false;
-    return restoreMacFrontmost(parseLsappinfo(execFileSync('lsappinfo', ['info', asn], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    })));
+    }).trim() === 'ok';
   } catch {
-    // Best effort: lsappinfo unavailable, timed out, or the pid has no Launch Services entry; nothing to restore.
+    // Best effort: osascript failed or timed out; the operator keeps whatever is in front.
     return false;
   }
 }
 
-// Bring `target` back in front of the launched browser. With `launchedBundlePath`
-// given, any other frontmost app is an intentional operator switch and is kept.
-function preserveMacFrontmost(target, launchedBundlePath) {
-  if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') return false;
-  if (process.platform !== 'darwin' || !target?.bundlePath || !Number.isInteger(target.pid) || target.pid <= 0) {
-    return false;
-  }
-  const front = captureMacFrontmost();
-  if (front && front.pid === target.pid) return true;
-  if (front && launchedBundlePath && !sameBundle(front.bundlePath, launchedBundlePath)) return false;
-  return restoreMacFrontmost(target);
-}
-
-function preserveMacFrontmostProcess(pid) {
-  if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') return false;
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  const current = currentFrontmostPid();
-  if (current === pid) return true;
-  return restoreMacFrontmostProcess(pid);
+// One check, at most one restore: 'restored' when our browser had the front
+// and `previous` got it back, 'kept' when anything else is in front (left as
+// is), 'off' when focus handling is disabled or there is nothing to restore.
+// A click on the slot window right after launch can therefore be undone once.
+function restoreFrontmostIfOurs(previous, ourPids) {
+  if (macFocusDisabled() || restored || !Number.isInteger(previous?.pid) || previous.pid <= 0) return 'off';
+  const ours = new Set((ourPids || []).filter((pid) => Number.isInteger(pid) && pid > 0));
+  if (ours.size === 0 || ours.has(previous.pid)) return 'off';
+  const front = macFrontmostPid();
+  if (front === null || !ours.has(front)) return 'kept';
+  restored = true;
+  return activateMacAppByPid(previous.pid) ? 'restored' : 'kept';
 }
 
 function macBackgroundOpenArgs(application, chromeArgs) {
   return ['-g', '-n', '-a', application, '--args', ...chromeArgs];
 }
 
-// Keep the previously focused app in front while `launchedBundlePath` starts.
-// The hold only counters the launched browser: the moment any other app is
-// brought to the front, the operator switched on purpose and the hold ends.
-function startMacFocusHold(targetOrPid, launchedBundlePath) {
-  if (process.env.MM_HARNESS_FOCUS_BROWSER === '1') return null;
-  if (process.platform !== 'darwin') return null;
-  const target = typeof targetOrPid === 'number'
-    ? { pid: targetOrPid, bundlePath: bundlePathForPid(targetOrPid) }
-    : targetOrPid;
-  if (!target?.bundlePath || !Number.isInteger(target.pid) || target.pid <= 0) return null;
-  return spawn(process.execPath, [
-    __filename,
-    '--hold',
-    String(target.pid),
-    target.bundlePath,
-    String(process.pid),
-    launchedBundlePath || '',
-  ], { stdio: 'ignore', env: toolEnv() });
-}
-
-function sameBundle(left, right) {
-  if (!left || !right) return false;
-  const real = (value) => {
-    try {
-      return fs.realpathSync(value);
-    } catch {
-      // A path that cannot be resolved is compared as given.
-      return value;
-    }
-  };
-  return real(left) === real(right);
-}
-
-function bundlePathForPid(pid) {
-  try {
-    const asn = execFileSync('lsappinfo', ['find', `pid=${pid}`], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }).trim();
-    return parseLsappinfo(execFileSync('lsappinfo', ['info', asn], {
-      encoding: 'utf8',
-      env: toolEnv(),
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: LS_TIMEOUT_MS,
-    }))?.bundlePath ?? null;
-  } catch {
-    // Best effort: lsappinfo unavailable, timed out, or the pid has no Launch Services entry; the hold is skipped.
-    return null;
-  }
-}
-
-function stopMacFocusHold(child) {
-  if (!child || !Number.isInteger(child.pid) || child.pid <= 0) return;
-  try {
-    process.kill(child.pid, 'SIGTERM');
-  } catch (error) {
-    if (error.code !== 'ESRCH') throw error;
-  }
-}
-
-function parentAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    // ESRCH or EPERM: the parent is gone or not ours; either way the hold must end.
-    return false;
-  }
-}
-
-if (require.main === module && process.argv[2] === '--hold') {
-  const pid = Number.parseInt(process.argv[3], 10);
-  const bundlePath = process.argv[4];
-  const parentPid = Number.parseInt(process.argv[5], 10);
-  const launchedBundlePath = process.argv[6] || '';
-  const target = { pid, bundlePath };
-  const hold = () => {
-    if (!parentAlive(parentPid)) process.exit(0);
-    const front = captureMacFrontmost();
-    if (front && front.pid === target.pid) return;
-    if (front && launchedBundlePath && !sameBundle(front.bundlePath, launchedBundlePath)) process.exit(0);
-    preserveMacFrontmost(target, launchedBundlePath);
-  };
-  hold();
-  setInterval(hold, HOLD_INTERVAL_MS);
-  setTimeout(() => process.exit(0), HOLD_MAX_MS);
-}
-
 module.exports = {
+  activateMacAppByPid,
   captureMacFrontmost,
-  captureMacFrontmostProcess,
   macBackgroundOpenArgs,
-  preserveMacFrontmost,
-  preserveMacFrontmostProcess,
-  restoreMacFrontmost,
-  restoreMacFrontmostProcess,
-  startMacFocusHold,
-  stopMacFocusHold,
+  macFocusDisabled,
+  macFrontmostPid,
+  restoreFrontmostIfOurs,
 };

package/adapters/extension/live.sh

@@ -185,6 +185,8 @@ if $LAUNCH_EXISTING_DIST && [ -z "$PREPARE_CMD" ]; then
   # seeded wallet persists across relaunches. A per-run profile made every
   # relaunch "foreign" and let live/ pruning delete profiles still in use.
   PROFILE_ABS="${CHROME_USER_DATA_DIR:-$TARGET/$RUNTIME_DIR/$CHROME_PROFILE_NAME}"
+  # One spelling per profile: ownership checks compare it exactly.
+  while [ "${PROFILE_ABS%/}" != "$PROFILE_ABS" ]; do PROFILE_ABS="${PROFILE_ABS%/}"; done
   case "$PROFILE_ABS" in
     "$TARGET/$RUNTIME_DIR/"*) ;;
     *) echo "--chrome-user-data-dir must be a dedicated child of $TARGET/$RUNTIME_DIR" >&2; exit 2 ;;
@@ -238,53 +240,31 @@ NODE
     fi
   fi
 
-  if [ -z "${CHROME_BIN:-}" ]; then
-    # bash 3.2 (macOS /bin/bash) mis-parses heredocs inside $(...): its scanner
-    # trips on quotes/backticks in the JS. Write the probe to a temp file and
-    # command-substitute a plain `node` invocation instead.
-    _chrome_probe="$(mktemp -t chrome-probe-XXXXXX)"
-    cat > "$_chrome_probe" <<'NODE'
-const fs = require('fs');
-const path = require('path');
-const { createRequire } = require('module');
-const requireFromTarget = createRequire(path.join(process.cwd(), 'package.json'));
-
-let chromium = null;
-function shellQuote(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`;
-}
-for (const pkg of ['@playwright/test', 'playwright']) {
-  try {
-    chromium = requireFromTarget(pkg).chromium;
-    if (chromium) break;
-  } catch (_error) {
-    // Optional Playwright package unavailable; try the next package name.
-  }
-}
-if (!chromium) {
-  console.error('[recipe-harness] Playwright is not available from this checkout; install dependencies first, or set RECIPE_HARNESS_CHROME_BIN to an explicitly approved browser.');
-  process.exit(1);
-}
-
-let executable = '';
-try {
-  executable = chromium.executablePath();
-} catch (error) {
-  const message = error && error.message ? error.message : String(error);
-  console.error(`[recipe-harness] Could not resolve Playwright Chromium executable: ${message}. Manual approval required before installing the Playwright Chromium browser cache (no package.json changes); ask the user before running yarn playwright install chromium.`);
-  process.exit(1);
-}
-if (!fs.existsSync(executable)) {
-  console.error(`[recipe-harness] Playwright Chromium is not installed at ${executable}. Manual approval required before installing the Playwright Chromium browser cache (no package.json changes). Ask the user for approval; if they agree, run: cd ${shellQuote(process.cwd())} && yarn playwright install chromium`);
-  console.error('[recipe-harness] To use a browser that is already installed, set RECIPE_HARNESS_CHROME_BIN=/path/to/chrome explicitly.');
-  process.exit(1);
-}
-
-process.stdout.write(executable);
-NODE
-    CHROME_PROBE_LOG="$ARTIFACTS/logs/chrome-probe.log"
-    CHROME_BIN="$(cd "$TARGET" && node "$_chrome_probe" 2>"$CHROME_PROBE_LOG" || true)"
-    rm -f "$_chrome_probe"
+  # The shared resolver picks the browser (RECIPE_HARNESS_BROWSER=auto|cft|
+  # chrome|<path>; RECIPE_HARNESS_CHROME_BIN wins) and records why, so the
+  # launcher knows how to load the extension and the run evidence names it.
+  # launch-browser.cjs starts a macOS .app through Launch Services, headful,
+  # so the probe does too.
+  BROWSER_RESOLVER="$SCRIPT_DIR/lib/browser-resolver.cjs"
+  [ -f "$BROWSER_RESOLVER" ] || BROWSER_RESOLVER="$SCRIPT_DIR/../shared/browser-resolver.cjs"
+  # A preserved profile keeps the browser recorded for it (auto never flips a
+  # profile between builds); the resolver bounds itself (probe + watchdog).
+  CHROME_PROBE_LOG="$ARTIFACTS/logs/chrome-probe.log"
+  BROWSER_RECORD="$TARGET/$RUNTIME_DIR/browser-resolution.json"
+  recorded_args=()
+  if ! $RESET_PROFILE && [ -f "$PROFILE_ABS/Local State" ] && [ -f "$BROWSER_RECORD" ]; then
+    recorded_args=(--recorded "$BROWSER_RECORD")
+  fi
+  CHROME_BIN="$(cd "$TARGET" && node "$BROWSER_RESOLVER" resolve --target "$TARGET" \
+    --launch-method launch-services --display headful ${recorded_args[@]+"${recorded_args[@]}"} \
+    --out "$BROWSER_RECORD" --out "$ARTIFACTS/logs/browser-resolution.json" \
+    2>"$CHROME_PROBE_LOG" || true)"
+  if [ -n "${CHROME_BIN:-}" ]; then
+    cat "$CHROME_PROBE_LOG" >&2 2>/dev/null || true
+  elif grep -q 'BROWSER_UNLAUNCHABLE:' "$CHROME_PROBE_LOG" 2>/dev/null; then
+    cat "$CHROME_PROBE_LOG" >&2
+    echo "[recipe-harness] No launchable browser on this machine; stopping before build or live Extension launch." >&2
+    exit 1
   fi
 
   if [ -z "${CHROME_BIN:-}" ]; then
@@ -345,7 +325,8 @@ NODE
     quoted_wallet_fixture="$(printf '%q' "$WALLET_FIXTURE_ABS")"
     prepare_parts+=("bash ${quoted_seed_fixture} prefill --target ${quoted_target} --fixture ${quoted_wallet_fixture} --state ${quoted_fixture_state} --profile ${quoted_profile} --extension-dir ${quoted_runtime_dist} --extension-id-file ${quoted_extension_id_file}")
   fi
-  chrome_launch_cmd="node ${quoted_chrome_launcher} --chrome-bin ${quoted_chrome} --profile ${quoted_profile} --cdp-port ${CDP_PORT} --extension-dir ${quoted_runtime_dist} --chrome-log ${quoted_chrome_log} --chrome-pid ${quoted_chrome_pid}"
+  quoted_browser_record="$(printf '%q' "$BROWSER_RECORD")"
+  chrome_launch_cmd="node ${quoted_chrome_launcher} --chrome-bin ${quoted_chrome} --browser-resolution ${quoted_browser_record} --profile ${quoted_profile} --cdp-port ${CDP_PORT} --extension-dir ${quoted_runtime_dist} --chrome-log ${quoted_chrome_log} --chrome-pid ${quoted_chrome_pid}"
   if [ -n "${START_URL:-}" ]; then
     chrome_launch_cmd="$chrome_launch_cmd --start-url $(printf '%q' "$START_URL")"
   fi

package/adapters/manifest.json

@@ -159,7 +159,7 @@
       "entry": "adapters/extension/live.sh",
       "kind": "bash",
       "purpose": "Sequencer: builds the prepare command from the named feature scripts, then launch + verify.",
-      "inputs": "--target --cdp-port --launch-existing-dist|--start-watch|--build-lavamoat|--prepare-cmd --dist-dir --chrome-user-data-dir --out --artifacts-dir; env RECIPE_HARNESS_CHROME_BIN, RECIPE_WALLET_FIXTURE, RECIPE_HARNESS_LIVE_KEEP",
+      "inputs": "--target --cdp-port --launch-existing-dist|--start-watch|--build-lavamoat|--prepare-cmd --dist-dir --chrome-user-data-dir --out --artifacts-dir; env RECIPE_HARNESS_BROWSER, RECIPE_HARNESS_CHROME_BIN, RECIPE_WALLET_FIXTURE, RECIPE_HARNESS_LIVE_KEEP",
       "outputs": "<artifacts>/summary.json + launch/ + verify/ + logs/fixture-source.json; exit 0/1/2"
     },
     {
@@ -279,8 +279,8 @@
       "entry": "adapters/extension/launch-browser.cjs",
       "kind": "node",
       "purpose": "Low-level spawn primitive: detached Chrome with isolated profile, CDP on 127.0.0.1, unpacked dist.",
-      "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid",
-      "outputs": "pid file + append-log; exit 0 / non-zero"
+      "inputs": "--cdp-port --chrome-bin --profile --extension-dir --chrome-log --chrome-pid [--browser-resolution]",
+      "outputs": "pid file + append-log + <runtime>/browser-resolution.json; exit 0 / non-zero"
     },
     {
       "id": "extension/validation-process-ownership",
@@ -304,7 +304,7 @@
       "kind": "bash",
       "purpose": "Ensure the slot's Chromium is running against the existing dist/profile/port (kills + relaunches).",
       "inputs": "--slot-id --repo --cdp-port --runtime-dir --watcher-port; env CHROME_USER_DATA_DIR, RECIPE_HARNESS_ROOT",
-      "outputs": "<runtime-dir>/{browser.pid,chromium.pid,extension.id}; exit 0/1"
+      "outputs": "<runtime-dir>/{browser.pid,chromium.pid,extension.id,browser-resolution.json}; exit 0/1"
     },
     {
       "id": "extension/inject",
@@ -506,6 +506,22 @@
       "inputs": "--target <checkout>",
       "outputs": "corepack yarn install output; exit 0/1/2"
     },
+    {
+      "id": "lib/browser-resolver",
+      "entry": "adapters/shared/browser-resolver.cjs",
+      "kind": "node",
+      "purpose": "Choose the extension browser (RECIPE_HARNESS_BROWSER=auto|cft|chrome|<path>; probe-launch Chrome for Testing, cached per machine and version, branded Chrome fallback) and load an unpacked extension over CDP for branded Chrome.",
+      "inputs": "resolve --target <checkout> [--launch-method spawn|launch-services] [--display headless|headful] [--recorded <file>] [--out <file>] [--json] | load-unpacked --port <cdp> --path <dist> --profile <dir> [--expect-id <id>] [--open-url <url>]; env RECIPE_HARNESS_BROWSER, RECIPE_HARNESS_CHROME_BIN, RECIPE_HARNESS_CHROME_CANDIDATES, RECIPE_HARNESS_BROWSER_CACHE",
+      "outputs": "executable path or resolution JSON on stdout; probe cache under ~/.cache/mm-harness; exit 0/1"
+    },
+    {
+      "id": "lib/browser-cdp",
+      "entry": "adapters/shared/browser-cdp.cjs",
+      "kind": "lib",
+      "purpose": "Browser-level CDP client with per-command deadlines; prove a CDP port belongs to a slot profile, load an unpacked extension (Extensions.loadUnpacked), audit for other user extensions.",
+      "inputs": "CDP port, extension dist, owning profile",
+      "outputs": "loaded extension id or an error; never loads into a browser it does not own"
+    },
     {
       "id": "lib/resolve-slot-ports",
       "entry": "adapters/shared/resolve-slot-ports.mjs",